Canva has confirmed that some enterprise customer records were exposed through Canny, a compromised third-party feedback tool connected to its Salesforce account, while recruitment software provider Bullhorn has taken its platform offline to contain a cyberattack. Supply chain compromises of the Rank Math PRO WordPress plugin and AOMEI Backupper lead the threat picture, alongside active exploitation of Plex Media Server and a signed Siemens program, and out-of-band F5 fixes for critical NGINX flaws.
Reporting window: 24 hours to 7:00 am AEDT, Tuesday 20 October 2026. Open sources only.
Australian focus
- Canva third-party data incident: unauthorised access to Canny exposed some enterprise customer records (business contact details, routine documentation) via its Salesforce connection; Canva says its platform, accounts and designs were not compromised. Seven Deadly Sins claims more than 2 million Salesforce records sold to a private buyer (claim unverified). Cyber Daily
- ANSTO among targets of Discover-Tech spyware ads: Citizen Lab found a cluster of ad impressions on Australian government, critical infrastructure, university and media networks, many linked to nuclear research; ANSTO reports no impact; ASD declined to comment. Follow-up to Episode 2. ABC News, Episode 2 notes
- AOMEI Backupper victims include Australian organisations: IT services, telecommunications and higher education among affected sectors. BleepingComputer
- ConnectWise cloud services still suspended: Cloud Backup, SaaS Security and Cloud Management remain off with no restoration timeline; relevant to Australian managed service providers. SecurityWeek, ConnectWise advisory
Global threat activity
- Bullhorn platform offline after cyberattack: system-wide outage since 17 October; CrowdStrike assisting; exfiltration not yet determined; non-SSO password resets and API password rotation required. BleepingComputer
- Rank Math PRO 3.0.123 trojanised: copies downloaded or updated between 20:02 UTC 15 October and 07:12 UTC 16 October contain a self-restoring backdoor; treat activated sites as compromised and restore from a pre-incident backup; clean version 3.0.124. SecurityWeek
- AOMEI Backupper update server tampering (UNC7017): configuration files briefly altered on 28 May, 16 July and 20 July to deliver CROSSROAD and SHINYROAD; AOMEI's CTO now leading an investigation; server fixes do not clean infected hosts. BleepingComputer
- Plex2Shell exploited: four chained Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) give unauthenticated code execution; miner and proxy backdoor deployed a day after the PoC; fixed in 1.43.3.10861 (3 August). The Hacker News, SecurityWeek
- Siemens Software Center abused in ClickFix attacks (CVE-2026-110936): signed binary side-loads attacker DLLs; linked to the Romulus ClickFix platform delivering LegionLoader; fixed in 4.0.9.8; no Siemens channel breached. SecurityWeek
- F5 out-of-band NGINX patches: critical CVE-2026-15176 and CVE-2026-97205 (HTTP/3 module) and CVE-2026-93479 (map directive); non-default configurations; not known to be exploited. BleepingComputer
- Ahold Delhaize confirms malicious actors: police report filed; no evidence of sensitive data theft; Albert Heijn deliveries due 23 October. The Record, Ahold Delhaize
- October Windows Server updates break Exchange: OWA sign-in and mail flow failures on heavily loaded servers; registry workaround available; do not uninstall updates. BleepingComputer, Microsoft Exchange Team
- GhostAction-linked fake font stealer: credential stealer in 94 GitHub repositories, launched by an editor task on folder open; possible copycat. The Hacker News, OpenSourceMalware
- Broadcom WPS flaw (WPSplinter): over-the-air root code execution on Broadcom-based routers; no CVE or fix; disable WPS. Quentin Kaiser, The Hacker News
AI security
- Former OpenAI engineer held without bail: prosecutors allege Saudi government support in the conference-room bugging case; single interception charge; defendant presumed innocent; OpenAI reports no indication of model weight access. CNBC, Al Jazeera (Reuters)
- REF8801 fake Web3 accelerator: malicious npm packages offering free Claude and Gemini credits drop stealers and backdoors and reroute coding agent model traffic. Elastic Security Labs
- LiteLLM gateway flaws: CVE-2026-35029 (configuration update authorisation bypass, fixed 1.83.0) and CVE-2026-59823 (SSRF exposing provider credentials, fixed 1.83.9). Check Point
- MITRE ATT&CK v20: direct and indirect prompt injection techniques, AI agent data theft, AI search poisoning, coding agent configuration files; adds The Gentlemen and a water utility PLC campaign. SecurityWeek, IronSights (Australian The Gentlemen victims)
Industry and strategic
- Anthropic and Opaque Systems: Anthropic takes on Opaque's confidential AI technology and engineers; reported as an acquisition by some outlets and a licence-and-hire deal by others; terms undisclosed. SecurityWeek, Opaque
Outlook and patch priorities
- Critical: rebuild sites that activated Rank Math PRO 3.0.123 in the window; update internet-facing Plex Media Server; ConnectWise tenants keep reviewing app credentials and sign-ins; confirm Siemens Software Center is on 4.0.9.8.
- High (this week): F5 NGINX; LiteLLM 1.83.9; Nextcloud Collabora Online built-in CODE server (CVE-2026-110447, exploited; update to 26.4.303 or remove the app); Exchange Server workaround. The Hacker News (Collabora)
- Watch: Bullhorn data theft determination; Canva notifications; AOMEI detailed response; LockBit deadline for Poole Group on 25 October. No new CISA KEV additions in the window. Banking Daily (Poole Group), CISA KEV
Indicators
- Rank Math PRO: block rank1cdn[.]com.
- AOMEI (UNC7017): 8.210.84[.]56; serv.oss-cn-hongkong[.]aliyuncs[.]com; hostnames under storage-data[.]com.
- Plex2Shell: miner host 217.60.194[.]116; attack sources 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222; mining pool ota.proxystream[.]st; processes "mylovelyminer", "myawesomeproxy".
- GhostAction-linked: my-github[.]com, 193.32.204[.]199.
- REF8801: apexaccs[.]org; packages @apexacc/cli, @apexacc/audit.
- ConnectWise: 144.172.64[.]128 (Huntress); further addresses in the ConnectWise advisory.